A critical linchpin in any network security strategy must include a regular vulnerability scan of all potentially vulnerable areas of an enterprise. Clone Systems has been providing on-demand vulnerability scanning solutions for several years, and our battery of tests are notably comprehensive and accurate.
Some background: web application attacks launched on port 80/443 bypass all firewalls, OS, and network level security, mainlining directly to your installed applications and business data on your network. Custom web applications are often insufficiently tested, which increases the likelihood of undiscovered vulnerabilities. Dynamic web technologies like AJAX and application communication delivered by SOAP or similar web services are also particularly vulnerable to malicious manipulation. In short, the more complex a technology is, the more likely it can be hijacked to perform really intrusive, damaging actions. Consequently, regulatory organizations like PCI, FFIEC, NERC CIP, FISMA now mandate a company secure all web applications from potential attacks.
Web Application Scanning Service – Clone Guard® CG-WebScan®
CG-WebScan® scans all applications residing on your enterprise’s web servers, proxy servers, web application servers, as well as all active web services. The scanner crawls your entire website, analyzing each file it finds and displays the entire website structure. It then performs an automatic audit for common web security vulnerabilities by launching a series of Web attacks. Web applications are deconstructed on the code level to reveal potentially malicious code sequences and embedded scripts that could launch an attack.
A total vulnerability solution for your enterprise should also include employing Clone Systems’ network vulnerability scanning product, CG-EVSS®, It scans all open network ports, IP addresses, and network-resident operating systems to safeguard all processing and data-handling across your entire network.
We are confident that CG-WebScan® is among the most refined and accurate web application vulnerability scanning solutions ever devised. We run literally thousands of scans per day, and are experts in both their deployment and their subsequent interpretation.
The net results of performing a web application audit using CG-WebScan
® are
- Enhanced web application security
- Improved risk visibility
- Diminished web application maintenance costs
- Compliance with regulatory agency mandates
Clone Systems recommends a complete vulnerability scan of a network at least on a quarterly basis.
CG-WebScan® Solution Features
- Detects vulnerabilities from a current database of known existing flaws
- Deep scanning capabilities detect and report alerts for the following types of vulnerabilities:
- Cross Site Scripting (XSS)
- SQL Injection Flaws
- Information Leakage and Improper Error Handling
- Broken Authentication and Session Management
- Failure to Restrict URL Access
- Improper Data Validation
- Cross Site Request Forgery (CSRF)
- Insecure Direct Object Reference
- Insecure Cryptographic Storage
- Insecure Communications
- Malicious File Execution
- Analyzes an application’s code content, including PHP, ASP, .NET components, and JavaScript
- Detects sensitive content in HTML (transaction card data, SSNs)
- Crawls and analyzes all website components, including Flash objects, SOAP app-to-app communication links, and AJAX routines
- Finds SQL injection flaws, cross-site scripting
- Uses browser emulation to find and test all links
- Deep level scans and through coverage
- Low false positives/negatives ratio
Many out of the box web application vulnerability scanners are available, but none come with the networking security credentials of Clone Systems. Our customized solution is constantly updated to reflect newly discovered problems and security flaws, and our results are guaranteed. Our many years of network security service stand behind every scan we perform.
For more technical information about the parameters we use for scans or to schedule a scan of your website infrastructure, contact one of our company’s service representatives.
Request a Quote
